Running an Arma 3 dedicated server on bare metal

What the server package is

Bohemia ships the server separately from the game: app 233780 on Steam, free, with a Linux build (arma3server_x64, plus a legacy 32-bit arma3server) and a Windows build. The supported hosts on the wiki are Windows Server 2008 or later and "a modern Linux distribution". The Linux section of the wiki is short and marked as a stub, so this page fills the gaps with standard Linux practice and says where it does.

Three files configure it. server.cfg (the name is free; -config= picks it) holds the hostname, passwords, mission rotation and security settings. basic.cfg (picked with -cfg=) holds network tuning such as MaxMsgSend. The profile, server.Arma3Profile, holds difficulty settings and is created on first start.

Sizing: one or two hot threads

The wiki's headless client notes explain why clock speed matters more than core count: the server and client processes start many threads, but most of the work runs on one or two of them, and all AI units share one thread however many are spawned. Its conclusion is that faster core speed is king, and, in notes written around Windows hosts, that moving the AI to several headless clients on the same computer will probably give the best results for complex AI-heavy missions. So size for per-core speed first, then for spare cores to run one or more headless clients beside the server.

Ports and firewall

All defaults are UDP, counted up from the game port set with -port=:

Outbound, BattlEye reaches its master on 2344 (TCP and UDP) and 2345 (TCP); ufw allows outgoing traffic by default, so nothing extra is needed. Bohemia says the server must answer ping (ICMP echo) for Steam to reach it. No rule is needed for that: ufw's default before.rules already accept IPv4 echo requests, and its before6.rules accept ICMPv6 echo once IPV6=yes is set. A second instance takes a block 100 ports up. Start it with -port=2402, its own -name= (on Linux that is what gives it a separate profile, since -profiles= is broken there) and its own -config=, and open it with sudo ufw allow 2402:2406/udp. The wiki warns that tighter spacing confuses the query port.

Install as a non-root user

Bohemia's Linux guide runs the server under its own account so that an attacker who compromises it finds the rest of the system harder to reach, and Valve warns against running SteamCMD as root. Run this as your own sudo user on Ubuntu or Debian. It creates the arma account, installs SteamCMD by Valve's manual method, creates the profile folders the wiki asks for, and turns the firewall on before anything listens:

sudo apt update && sudo apt install -y lib32gcc-s1 curl ufw
sudo useradd -m -s /bin/bash arma
sudo -u arma bash -c 'mkdir -p /home/arma/steamcmd /home/arma/cfg && chmod 700 /home/arma/cfg'
sudo -u arma bash -c 'cd /home/arma/steamcmd && curl -sqL "https://client-update.steamstatic.com/installer/steamcmd_linux.tar.gz" | tar zxvf -'
sudo -u arma bash -c 'mkdir -p "/home/arma/.local/share/Arma 3" "/home/arma/.local/share/Arma 3 - Other Profiles"'

# firewall: IPv6 handling on BEFORE any rule, then SSH and the Arma block
sudo sed -i 's/^IPV6=.*/IPV6=yes/' /etc/default/ufw
sudo ufw default deny incoming
sudo ufw allow OpenSSH
sudo ufw allow 2302:2306/udp
sudo ufw --force enable
sudo ufw status verbose

The game itself does not speak IPv6, but the sed line still matters: ufw only writes IPv6 copies of rules added while IPV6=yes, so setting it first keeps SSH and the default deny in force on the machine's IPv6 address too.

The Steam login, without the password on a command line

App 233780 is not an anonymous download in Bohemia's guide: SteamCMD logs in with a Steam account. Bohemia says that account needs no Arma 3 purchase, and advises a new account used only for the server, because SteamCMD caches the login and anyone who gets into the server can use it. A Steam account also cannot be logged in from two places at once. Bohemia's Windows example writes the password into a batch file; don't, because a password passed as an argument shows in ps and lands in shell history. Use SteamCMD's own prompt instead:

Type each line on its own and wait for the prompt to come back. A block pasted in one go would feed the next line into the password prompt.

1. Open a shell as the service user with sudo -iu arma, then start /home/arma/steamcmd/steamcmd.sh. On first run it updates itself and leaves you at the Steam> prompt.
2. Type force_install_dir /home/arma/arma3 (Valve's documentation sets the directory before logging in).
3. Type login yourserveraccount with the username only. SteamCMD asks for the password; type it at that prompt. If Steam Guard is on, it then asks for the access code Steam emails you. Valve says the code is needed only on the first login, or after the files holding the cached login are deleted.
4. Type app_update 233780 validate, wait for the success line, then quit.

server.cfg: passwords, BattlEye, signatures

Keep the config outside the install folder. The wiki's security section notes that the engine accepts an absolute path for configs and that script file commands such as loadFile only read inside the Arma 3 folder, so a config kept elsewhere is out of their reach. It also survives validate, which Valve warns overwrites changed files in the install. A starting point, using settings from the wiki's server config page:

// /home/arma/cfg/server.cfg - owner arma, chmod 600
hostname = "Example Arma 3 server";
password = "";                       // join password; empty means public
passwordAdmin = "change-this-admin-secret";
serverCommandPassword = "change-this-script-secret";
admins[] = { "76561198000000000" };   // Steam UIDs that may #login with no password
maxPlayers = 40;
persistent = 1;
kickDuplicate = 1;
BattlEye = 1;
verifySignatures = 2;
allowedFilePatching = 0;
headlessClients[] = { "127.0.0.1" };
localClient[] = { "127.0.0.1" };
class Missions {};

Then sudo chmod 600 /home/arma/cfg/server.cfg with arma as owner, and never put any of the three passwords on the start line. passwordAdmin is what #login checks in game; serverCommandPassword guards the alternate syntax of the serverCommand scripting command; admins[] (since 1.70) lets listed UIDs log in as admin without the password. Without BattlEye RCon only one admin can be logged in at a time. The wiki also recommends the allowedLoadFileExtensions[], allowedPreprocessFileExtensions[] and allowedHTMLLoadExtensions[] lists from its security section on public servers; copy them from there.

BattlEye = 1 is the default and needs BattlEye on the server and on every client. BattlEye keeps its folder inside the server profile unless -bePath= moves it, and its script filters have to be written per mission and mod.

Mods, keys and the start command

On Linux, -mod= takes paths relative to the Arma 3 folder or below it (symlinks work), so place each @mod folder under /home/arma/arma3. -serverMod= loads server-side mods that are not broadcast to clients. Some mods, CUP Terrains and ALiVE among them, break if any file name has capitals, which Linux treats as different names; the wiki lowercases the whole mod tree to cure it. With verifySignatures = 2, players may only load addons signed by a key in the server's keys folder, which usually holds only bi.bikey after a fresh install: copy in the .bikey of each mod you run, and only from authors you trust. The unit file, /etc/systemd/system/arma3.service:

[Unit]
Description=Arma 3 dedicated server
After=network-online.target
Wants=network-online.target

[Service]
User=arma
Group=arma
WorkingDirectory=/home/arma/arma3
ExecStart=/home/arma/arma3/arma3server_x64 -name=server -port=2302 -config=/home/arma/cfg/server.cfg
Restart=on-failure

[Install]
WantedBy=multi-user.target

Run sudo systemctl daemon-reload && sudo systemctl enable --now arma3 and follow it with journalctl -u arma3 -f. Don't add -profiles=: the wiki says it does not work on Linux, and the profile lands in ~/.local/share/Arma 3 - Other Profiles/server/. For one mod, append -mod=@cba_a3. For several, the wiki's Linux syntax puts a backslash before each semicolon, and a unit file has no shell to remove it. Our arrangement, not the wiki's: a one-line script, /home/arma/start.sh, holding exec /home/arma/arma3/arma3server_x64 -name=server -port=2302 -config=/home/arma/cfg/server.cfg -mod=@cba_a3\;@mymod, with the unit changed to ExecStart=/bin/bash /home/arma/start.sh. Bohemia's example wraps the -mod value in double quotes; leave it unquoted here, because inside double quotes bash keeps the backslash and the server would receive it. Updates are manual: Bohemia's guide says to update the server whenever a patch is released on Steam, so stop the service, open SteamCMD as arma again and type force_install_dir /home/arma/arma3 before login yourserveraccount, followed by app_update 233780 validate, then quit. Without force_install_dir, SteamCMD installs a second copy elsewhere. Then start the service.

Headless clients

A headless client is the same Linux binary started with -client, for example ./arma3server_x64 -client -connect=127.0.0.1 -port=2302 -name=hc1; it takes a free headless slot, and you can run several on one machine. Three conditions: its IP is in headlessClients[] (and in localClient[] for unthrottled bandwidth), the mission contains named Headless Client units, and the mission's scripts send the AI to it. On a modded server it needs the same -mod= list as the server. Headless clients skip signature verification, and -serverMod= does not work with -client. If the server has a join password, the client needs it, and -password= would show in ps. The wiki's startup parameter file keeps it in a file instead: plain text, one option per line, with any extension except .par (a .par name switches to a class format that the wiki says is apparently no longer read correctly on a dedicated server). So use /home/arma/cfg/hc1.txt at chmod 600, passed by absolute path as -par=/home/arma/cfg/hc1.txt; the wiki doesn't say whether that was tested on Linux, so check ps -o args -u arma after starting.

Which of our machines fit

The game server machines are whole servers configured to the game, with the operating system you choose, in New York, Miami, San Francisco, Amsterdam or Bucharest; ping each city's test IP on the data center page before choosing. One IPv4 address is part of every server, and IPv4 is the only family Arma 3 can serve on. The port is unmetered: 1 Gbps on most lines, 500 Mbps on the rest. Rack servers and blades carry an out-of-band controller (HPE iLO, Dell iDRAC or a Supermicro BMC) with a browser console, which gets you back in if a firewall rule locks out SSH.

Pick by clock speed. Most processors in the range are previous-generation by design, and the Intel processor page lists each Intel processor's base and turbo frequency next to the machine it is sold in. A racked machine is live about 30 minutes after the order is approved; a build to order takes 4 to 24 hours. Support is 24/7 by phone, email and live chat, and the Squad notes cover a related milsim server.

Wrong fit: a casual co-op night for a few friends doesn't need a separate machine; Bohemia's Launcher can start the game exe as a server with the selected mods. Mission scripting, BattlEye filters and mod curation stay with you. Copy mission files, configs and the profile off the machine yourself.